Audit Docker Volumes Safely with docker volume ls

docker volume ls gives you a read-only inventory of every volume Docker knows about, the first thing to reach for before any cleanup gets ideas. Allow about ten minutes to work through listing, filtering by name, driver, label and dangling status, and producing output a script can trust.

You need the Docker CLI and access to the Docker daemon; no elevated privilege is normally needed. This guide uses Docker CLI 29.8.1 from the installed docker-ce-cli package, version 5:29.8.1-1~ubuntu.24.04~noble. Output will vary with the volumes present on your host.

1. Confirm the command and daemon access

Start with the built-in help. This is an ordinary read-only command:

$ docker volume ls --help
Usage:  docker volume ls [OPTIONS]

List volumes

Check the client version separately, then ask Docker for the current inventory:

$ docker version --format '{{.Client.Version}}'
29.8.1
$ docker volume ls
DRIVER    VOLUME NAME
local     example-data

The normal table has a driver column and a volume name column. If the last command reports a daemon connection error, stop there: check that Docker is running and that your account can access its socket. Use sudo only if your host's Docker setup explicitly requires it, because adding privilege does not fix a stopped or remote daemon.

2. Read the full inventory without touching data

docker volume ls lists volumes known to Docker, not files found by scanning the host filesystem. It does not mount, inspect, create or remove a volume, and an empty table is a perfectly valid result if this Docker environment has none.

For a compact list that is easy to pass to another command, add --quiet:

$ docker volume ls --quiet
example-data
cache-data

Names are the safest field to feed into a later Docker command. Keep one name per line, and do not assume a volume name is a directory path: the volume driver manages that, not you.

3. Find volumes by name or driver

Filters use a key=value form:

• name matches all or part of a volume name. Use a distinctive fragment so it does not catch more than you expect.
• driver narrows by driver. The common built-in driver is local, but a plugin-created volume may use another name entirely.

$ docker volume ls --filter 'name=project'
DRIVER    VOLUME NAME
local     project-db
local     project-uploads

$ docker volume ls --filter 'driver=local'
DRIVER    VOLUME NAME
local     example-data

Output is host-specific, and a blank result means the filter matched nothing, not that something is broken. Stack more than one filter flag when you need to narrow a report:

$ docker volume ls --filter 'driver=local' --filter 'name=project'

Do not confuse a partial name match with an exact lookup. Before using a returned name in a later operation, copy it from --quiet output or verify it with docker volume inspect.

4. Use labels as an ownership check

Labels earn their keep once several projects share one Docker host. A label-only filter matches volumes carrying that key, whatever its value:

$ docker volume ls --filter 'label=project'
DRIVER    VOLUME NAME
local     project-db

Add a value for a narrower result:

$ docker volume ls --filter 'label=project=payments'
DRIVER    VOLUME NAME
local     payments-db

Quote the complete filter. That protects label values containing shell-significant characters and keeps the key-value boundary visible. A missing or misspelled label simply produces no matching rows; it does not search the volume's contents.

5. Identify volumes that are not referenced by containers

The dangling filter selects volumes no container references. It is useful for review, not automatic housekeeping:

$ docker volume ls --filter 'dangling=true'
DRIVER    VOLUME NAME
local     old-cache

Use false for volumes that are referenced, or the boolean forms 1 and 0, which this command also accepts:

$ docker volume ls --filter 'dangling=false' --quiet
project-db
project-uploads

6. Produce stable output for a report

Use --format when column spacing is not suitable for automation. A Go template selects fields without headers:

$ docker volume ls --format '{{.Name}}: {{.Driver}}'
example-data: local
project-db: local

Useful placeholders include .Name, .Driver, .Scope, .Mountpoint, .Labels and .Label. This records names and scopes to a file:

$ docker volume ls --format '{{.Name}}	{{.Scope}}' > volume-report.tsv
$ sed -n '1,5p' volume-report.tsv
example-data	local

The redirection creates or replaces a local report file, so choose its path deliberately. If you need structured records instead, the installed CLI also accepts the json format:

$ docker volume ls --format json
{"Driver":"local","Labels":"","Mountpoint":"/var/lib/docker/volumes/example-data/_data","Name":"example-data","Scope":"local"}

Treat mountpoints as operational data. They can disclose host layout, and seeing one is not a promise that you should edit the directory directly: use Docker's volume commands and the driver's own documentation for anything further.

7. Verify a result before acting on it

Once a filter finds a candidate, repeat the name-only query and inspect the exact volume before running any state-changing command:

$ docker volume ls --filter 'name=project' --quiet
project-db
$ docker volume inspect project-db

If the name-only output is empty, do not substitute a guessed directory or a similar-looking name. If several names come back, review each one. This small pause is what stops a partial filter match turning into an accidental operation on the wrong volume.